44d3d3a9f65e89e23e0736db9a4a3c66

Sharing

Copy URL Twitter E-mail

General

Target

44d3d3a9f65e89e23e0736db9a4a3c66
Size

5.6MB
MD5

44d3d3a9f65e89e23e0736db9a4a3c66
SHA1

2972ad675ec929a9e01bc34a235047bf6f23d487
SHA256

561df7de9c7f99d2e2bcba5a095c15a659984c91f4ef2e551443594cc4efb65f
SHA512

6d7c6b893859d6a64df061abad88bb2016f0e5fbf79693dc2c9a15cf59348112875ebace3ce2c5a3a1c2afb5126c2cf33fc6dfccf8f0b4a777949a841558e884
SSDEEP

98304:3GKhi2exY8gTdllLrfHLw5Zc19fKfYkl7mxeE0CVN2zpTd9Hw1wA:Fi2Nbxw5Zc/KwkyeFC/2hY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44d3d3a9f65e89e23e0736db9a4a3c66

Files

44d3d3a9f65e89e23e0736db9a4a3c66
.exe windows:4 windows x86 arch:x86

245c6bf9bc49cef46d56dcb0cf326d57

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
GetFullPathNameA
WriteProcessMemory
CancelWaitableTimer
EnterCriticalSection
ReadConsoleA
UnregisterConsoleIME
VirtualAlloc
WriteConsoleInputA
LoadModule
GlobalFree
IsBadStringPtrA
DeleteCriticalSection
SetErrorMode
Heap32ListNext
InitializeCriticalSection
GetProcessWorkingSetSize
PeekConsoleInputA

user32

EnumPropsA
ExcludeUpdateRgn
DialogBoxIndirectParamA
FreeDDElParam
QuerySendMessage
GetDlgItemTextA
GetKeyboardType
DrawAnimatedRects
DrawTextExW
ShowWindow
CopyImage
InSendMessageEx
CliImmSetHotKey
ModifyMenuA
GetWindowRgn

authz

AuthzOpenObjectAudit

imagehlp

TouchFileTimes

dsound

DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCreate8
DirectSoundCaptureEnumerateW

Exports

Exports

Gnwtqgrso
Vtefddgkgd
Wugfpdqx
Rrqbunni
OpenNmwmkvcs
EndPixbwvsdjh
Dbmitnugu
SetHqwukdmtttj
ReadIaersdge
InitRqxseoqi
SetJrwudfom
Lmjkhkxahh
Pkfnmav
CloseDoyrbqfd
IsUlikytce
GetLumrrtho
GetBmkajiuq
Fmotuwtuitl
EndXtklwgtba
EndPgpusocsjp
Ebauhyk
EndAnubpdkb
IsRhellfwe
Davcwualrsu
Orqjtdktji
OpenNrheagyayv
AddKyapirj
Rkheimhmekl
Wdfoyhbmm
Wptgghn
Qtgcoynqcpw
Xnuaievc
EndHeqrebljndt
CloseRulotoskkx
InitDddjkxnourx
IsSishksbnxq
AddHepwitxch
AddNluvtstiwcf
CreateQbyxosavp
OpenBhwykecfgh

Sections

.text
Size: 770KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 408KB - Virtual size: 407KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 98KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

245c6bf9bc49cef46d56dcb0cf326d57

Headers

File Characteristics

Imports

kernel32

user32

authz

imagehlp

dsound

Exports

Exports

Sections

.text Size: 770KB - Virtual size: 769KB

.data Size: 408KB - Virtual size: 407KB

.data Size: 98KB - Virtual size: 437KB

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 2KB

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: 770KB - Virtual size: 769KB

.data
Size: 408KB - Virtual size: 407KB

.data
Size: 98KB - Virtual size: 437KB

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 6KB - Virtual size: 6KB